Cross-Site Scripting (XSS) vulnerability in BI Platform and BI Launch Pad, SAP security note 2290512

SAP security note 2290512, "Cross-Site Scripting (XSS) vulnerability in BI Platform and BI Launch Pad". Below are the symptom, SAP recommended solution and the CVSS score.

Description

Symptom

SAP BusinessObjects Business Intelligence Platform (BI) 4.0 and BI Launch Pad (BILP) do not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability. This can lead to:

• Non-permanently defacing or modifying displayed content on a website.
• Stealing authentication information of the user, such as session data.
• Impersonating the user to access information with the same rights as the target user.

Solution

This vulnerability is addressed in the following support package patch:

• SBOP BI PLATFORM SERVERS 4.1 SP006/000009 – View Patch

CVSS

Score 5.4 / 10 Vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N